How to read this map — ipcensus.org

Addresses

Every machine on the internet that talks to others has an address. IPv4 addresses are 32-bit numbers, usually written as four numbers from 0 to 255, like 8.8.8.8. There are 4,294,967,296 of them, and they ran out: the registries handed out the last unallocated blocks years ago, which is why a newer system, IPv6, exists beside it. This plate draws IPv4. The IPv6 layer draws a thin slice of the other system, from web records only: records are per /32 under 2000::/3, drawn one pixel per /27 at full zoom.

Blocks

Addresses are given out in blocks whose size is a power of two. The notation /24 means “the first 24 bits are fixed”, which leaves 8 bits free: 256 addresses. A /16 is 65,536 addresses. A /8 is 16,777,216, and there are 256 of them; 35 of those are reserved for things like multicast and private networks and are hatched on the map because nothing public can ever live there.1

This diagram is drawn in your browser.

Each step down is 256 times smaller. A /24 is three steps below the whole plate.

The curve

A map needs an order. The obvious one, reading addresses like words on a page, scatters every network into strips. The Hilbert curve instead folds the line of addresses into a square so that neighbours stay neighbours. Zoomed out, each pixel is a /16; zoom four steps and each pixel is a /24. The curve starts at the top-left corner with 0.0.0.0 and ends at the top-right with 255.255.255.255, so the whole reserved top end, 224.0.0.0/3, is the hatched block in the top-right eighth.

This diagram is drawn in your browser from the map's own Hilbert function.

The same 16 blocks, laid out two ways. In rows they are a strip; on the curve they are a square. Every network on the plate is a square or a 2:1 oblong for the same reason.

Nameservers

Type a domain into a browser and the first thing that happens is a question: “which addresses answer for this name?” The machines that answer are the domain's nameservers. Their names are published in the zone file of the domain's top-level domain (.com, .app, .xyz), which ICANN lets researchers read. The census reads — of those zone files every day, complete, and learns each nameserver's IPv4 address from the same files and its own slow lookups.2 A domain with no working nameserver is a domain nobody can reach, which is why they matter more than the website's own address.

What is not here

Country-code zones (.de, .uk, .cn, .br, .jp …) are not in CZDS, so they are not in this census.3 Everything on this site is about the generic top-level domains. A finding like “— of domains” means — of the classifiable domains in those — zones, and the specialist note on every number says so.

Networks

Addresses are announced to the internet in routes, and every route comes from an autonomous system, an AS, with a number: AS13335 is Cloudflare, AS15169 is Google. The map labels every block with the ASNs that announce its occupied addresses. Two things an ASN is not: it is not a company (one company may announce from many ASNs, and one ASN may be registered to a subsidiary with a different name), and it is not a place.

Announces, registered, located

Three different facts, and this map uses the first two only.

Announces: who tells the routing system how to reach the block. Observed in a public routing table.
Registered: the country the announcing network's registry record names. A legal fact about paperwork. GoDaddy's DNS network is registered in Germany. The block itself has its own registry record, and the two can differ: the map's “registry country” tier (T4) uses the block's.
Located: where the machine physically is. The map says this only when a cloud provider publishes one region for every occupied address in the block (tier T2). Anycast addresses, the ones the big DNS providers use, answer from dozens of cities at once and are honestly “not a place”.

Counting

A block's number is a count of domains with a nameserver there. A domain with nameservers in two blocks counts once in each. So the map's totals are domain–prefix incidences, which can exceed the number of domains; the findings that say “domains” use a different, stricter count and say which.

Glossary

/24: A block of 256 IPv4 addresses whose first 24 bits are fixed. One pixel on the map at full zoom, and the longest prefix most networks accept into the global routing table.
Autonomous system (AS, ASN): A set of address prefixes under one routing policy, with a number from a regional registry. It is the “network” in every network figure here. It is not a company and not a place.
Anycast: One address announced from many sites at once, so each user reaches the nearest copy. The big DNS providers use it. The map calls it “not a place”.
Bogon: An address that should never appear on the public internet: private, reserved or unallocated. Bogon nameserver addresses are dropped before counting.
CZDS: ICANN's Centralized Zone Data Service, through which researchers read the zone files of the generic top-level domains. The census's source for every domain and nameserver.
Dark under a network: A domain is dark under network X when every address of every one of its nameservers is announced by X: if X disappeared, nothing would answer for the domain.
Classifiable domain: A domain whose every nameserver has at least one known, public IPv4 address. Only these can be counted as dark or not; the rest are excluded from every share.
Domain–prefix incidence: One domain having a nameserver (or website) in one /24. A domain with servers in three blocks is three incidences. The map's colours and totals count these.
gTLD, ccTLD: Generic top-level domains (.com, .org, .app, .xyz) are in CZDS and in this census. Country-code top-level domains (.de, .uk, .cn) are not.
Glue record: An address for a nameserver published in the parent zone file itself, so the nameserver can be found. The census learns most nameserver addresses from glue and looks up the busiest of the rest itself.
Hilbert curve: A path that fills a square, visiting every cell once without jumping, so numbers that are close stay close on the page. The map's order 12 curve has 4,096 × 4,096 cells, one per /24.
Nameserver: A server that answers “which addresses belong to this name?” for a domain. Every domain lists its nameservers in its zone file.
RIR: A Regional Internet Registry: AFRINIC, APNIC, ARIN, LACNIC or RIPE NCC. They give out address blocks and record the holder's country.
Tier T2 / nonregional / T4 / unknown: How much the map can say about where a block is. T2: a cloud provider publishes one region for every occupied address. Nonregional: provider ranges that are not one place, such as anycast. T4: only the registry country. Unknown: mixed or no data, never guessed.

How it is counted, and its limits →